Regulation (EU) 2026/2359 reforms the coordination of social security systems across Europe and affects all companies that post employees to other EU Member States. It retains the 24-month limit but requires three months of prior coverage under the social security system, mandatory notification before each posting and stricter controls on the A1 certificate from 2 November 2028.
On 27 October 2026, Regulation (EU) 2026/2359 of the European Parliament and of the Council of 7 October 2026 was published in the Official Journal of the European Union. The Regulation amends Regulation (EC) No 883/2004 on the coordination of social security systems and its implementing regulation, Regulation (EC) No 987/2009.
For companies with international mobility, its main focus is on the rules determining the applicable legislation, i.e. which social security system applies to each individual. This particularly affects posted workers and those who work simultaneously in several Member States.
The starting point: how coordination works
The general rule is that workers are subject to the legislation of the Member State in which they carry out their activity. There are two main exceptions to this rule. The first is posting (Article 12 of Regulation 883/2004): workers temporarily posted to another Member State remain subject to the social security system of their home Member State for a maximum of 24 months. The second is working in two or more Member States (Article 13): individuals who normally work in two or more Member States are subject to the legislation of only one Member State.
This situation is certified by the A1 certificate, issued by the institution of the Member State whose legislation is applicable. Regulation 2026/2359 does not change this framework. Instead, it clarifies the requirements, introduces additional formal obligations and provides the authorities with more effective monitoring tools.
Implementation timeline
Although the Regulation enters into force on 1 November 2026, its application is phased. The key dates for companies are as follows:
| Date | Applicable provisions |
|---|---|
| 1 November 2026 | Entry into force. Obligation for the issuing institution to properly assess the facts before issuing the A1 certificate and use of a standardised certificate format (Articles 19(2) and 19(3) of Regulation 987/2009). Enhanced data exchange between institutions (Article 2(2a)). Transitional provisions. |
| 2 November 2028 | New Article 12 of Regulation 883/2004 and posting requirements (Article 14 of Regulation 987/2009); prior notification (Article 15); review of documents (Articles 5, 19a and 20); working in two or more Member States (Articles 14 and 16); unemployment, long-term care and family benefits. |
| 2 November 2036 | End of the maximum transitional period for individuals whose applicable legislation changes as a result of the new rules (Article 87b(4) of Regulation 883/2004). |
In addition, there is a transitional period: if, under the new rules, an individual becomes subject to legislation different from that previously applicable, the previous legislation will continue to apply as long as their circumstances remain unchanged, and no later than 2 November 2036.
What changes for posted workers
The new Article 12 retains the 24-month limit on the anticipated duration of a posting. The main changes concern the requirements surrounding it.
Recruitment for posting. An individual recruited specifically to be posted may only qualify under the posting rules if they have been subject to the legislation of the employer's Member State for at least three months immediately before starting employment (Article 14(1) of Regulation 987/2009). The same three-month period of prior activity is required for self-employed individuals (Article 14(3)).
Replacement of posted workers. Article 12 generally prohibits a posted worker from replacing another posted worker. This is only permitted where the work has not been completed and the total duration of the work carried out by all individuals successively occupying the position does not exceed 24 months (Article 12(3)).
The change with the greatest operational impact is the revised wording of Article 15 of Regulation 987/2009. The employer, or the self-employed individual, must notify the competent institution (in Spain, the General Treasury of Social Security) before the activity begins and apply for the A1 certificate.
What happens if this requirement is not met? Failure to comply does not, in itself, result in a change to the applicable legislation. However, Member States may adopt proportionate measures against the employer in accordance with their national law, the extent of which will depend on each country's penalty regime.
Prior notification is not required in two cases (Article 15(1b)): business trips, i.e. those that do not involve providing a service or supplying goods, and activities lasting no more than three consecutive working days within a period of thirty consecutive days, except in the construction sector.
These exemptions only remove the notification requirement. Workers remain subject to the legislation of their home Member State under Article 12. In addition, the company must be able to demonstrate that the activity qualifies for an exemption.
A specific review procedure is established (Article 19a): if the host Member State has doubts about the validity of the certificate, the issuing institution must review it and, if an error is identified, withdraw or correct it within 30 working days, with retroactive effect. In cases of fraud, withdrawal will be immediate.
The overall effect is clear: the A1 certificate retains its binding force, but is no longer a document that is difficult to challenge.
Workers Carrying Out Activities in Several Member States
For individuals working in two or more Member States, the company's registered office or place of business will be determined by the location where its key decisions are taken and the functions of its central administration are carried out (Article 14(5a)). This makes it more difficult for a merely formal registered office to be used to determine the applicable legislation. In addition, the determination of the applicable legislation will remain valid for a maximum of 24 months, after which it must be reassessed (Article 14(10)).
Conclusion
Regulation (EU) 2026/2359 maintains the principles of European social security coordination but substantially changes their practical application. The period until November 2028 provides sufficient time to adapt, but only if it is used to review processes involving several departments.
Does your company know how many of its business trips to other Member States legally qualify as postings? Does it have a procedure in place to ensure prior notification and the retention of supporting documentation?
👉 Access the comparison table between the previous and new rules here.
Frequently Asked Questions About Regulation (EU) 2026/2359
Is It Necessary to Notify Social Security of a Business Trip to Another EU Country?
No, from 2 November 2028 onwards. Business trips are exempt from the prior notification requirement (Article 15(1b) of Regulation 987/2009). These include attending business meetings, cultural and scientific events, conferences and seminars, as well as receiving training. However, if the worker provides a service or supplies goods, such as carrying out an audit, installation work or consultancy services for a client, this does not qualify as a business trip. The company must be able to demonstrate that the activity qualifies for an exemption.
What Is the Acknowledgement of Receipt and What Documentation Must the Company Retain?
It is the automatic acknowledgement issued by the competent institution (in Spain, the General Treasury of Social Security) when it cannot issue the A1 certificate immediately. It confirms that prior notification has been submitted. From 2 November 2028, if requested by the host Member State, the employer must provide this acknowledgement or evidence that the activity qualifies for an exemption, and supply the posted worker with the supporting documents, either in paper or electronic format.
Can the Host Country Require Social Security Contributions If There Is No A1 Certificate?
Yes, in certain cases. If a worker provides services without an A1 certificate and the activity is not exempt from the notification requirement, the host Member State may request information from the Member State that would be competent. If no response is received within 35 working days, the host Member State may act as if the certificate had never been issued (Article 20(4) of Regulation 987/2009, applicable from 2 November 2028). In practice, this allows the host Member State to require social security contributions to be paid there.
What Happens to Postings Already Underway in November 2028?
They will continue to be governed by the existing rules. The previous version of Article 12 applies to workers posted before 2 November 2028: a posting that began in October 2028 may therefore continue for the full 24-month period. The Regulation does not clarify whether the prior notification requirement applies to these ongoing postings. A reasonable interpretation is that it only applies to postings starting on or after that date, pending guidance from the Administrative Commission and the General Treasury of Social Security.
How Long Must a Company Wait Before Posting the Same Worker to the Same Country Again?
At least two months, from 2 November 2028 onwards. When a worker has been posted to a Member State for a total of 24 months, with interruptions of no more than two months, they must wait two months from the end of the posting before being posted to the same Member State again (Article 14(1a) of Regulation 987/2009). Short interruptions do not reset the 24-month period. An exception is only possible by agreement between the Member States concerned (Article 16 of Regulation 883/2004).
Related content
